Ports are the numbers representing different
services on a server; such as port 80 for HTTP and port 110 for POP3. You
can find the list of standard port numbers and their services in
/etc/services. SSH can translate transparently all traffic from an arbitrary port on
your computer to a remote server running SSH. The traffic then can be
forwarded by SSH to an arbitrary port on another server. Why would you
want to do this? Two reasons: encryption
and tunneled connections.

Encryption

Many applications use protocols where passwords and data are sent
as clear text. These protocols include POP3, IMAP, SMTP and NNTP.
SSH can encrypt these connections transparently.
Say your e-mail program normally connects to the POP3 port (110)
on mail.example.net. Also, say you can't SSH directly
to mail.example.net, but you have a shell login at
shell.example.net. You can instruct SSH to encrypt traffic from port 9110 (chosen
arbitrarily) on your local computer and send it to port 110 on
mail.example.net, using the SSH server at shell.example.net:

ssh -L 9110:mail.example.net:110 shell.example.net

That is, send local port 9110 to mail.example.net port 110, over an SSH
connection to shell.example.net.

Then, simply tell your e-mail program to connect to port 9110 on
localhost. From there, data is encrypted, transmitted to
shell.example.net over the SSH port, then decrypted and passed to
mail.example.net over port 110.
As a neat side effect,
as far as the POP3 dæmon on mail.example.net knows, it is
accepting traffic from shell.example.net.

Tunneled Connections

SSH can act as a bridge through a firewall whether the firewall is
protecting your computer, a remote server or both. All you need is
an SSH server exposed to the other side of the firewall.
For example, many DSL and cable-modem companies forbid sending e-mail
from your own machine over port 25 (SMTP).

Our next example is sending
mail to your company's SMTP server through your cable-modem connection.
In this example, we use a shell account on the SMTP server, which is
named mail.example.net.
The SSH command is:

ssh -L 9025:mail.example.net:25 mail.example.net

Then, tell your mail transport agent to connect to port 9025 on
localhost to send mail. This exercise should look quite similar
to the last example; we are tunneling from local port 9025 to
mail.example.net port 25 over mail.example.net.
As far as the firewall sees, it is passing normal SSH data on the normal
SSH port, 22, between you and mail.example.net.

A final example is connecting through an ISP firewall to a mail
or news server inside a restricted network. What would this look like?
In fact, it would be the same as the first example; mail.example.net
can be walled away inside the network, inaccessible to the outside
world. All you need is an SSH connection to a server that can see it,
such as shell.example.net. Is that neat or what?

Limitations/Refinements to Port Forwarding

If a port is reassigned on a computer (the local port in the examples
above), every user of that computer sees the reassigned port.
If the local system has multiple users, tunnel only from unused,
high-numbered ports to avoid confusion. If you want to forward a
privileged local port (lower than 1024), you need to do so as root.
Forwarding a lower-numbered port might be useful if a program won't let you
change its port, such as standard BSD FTP.

By default, a tunneled local port is accessible only to local users and
not by remote connection. However, any user can make the tunneled
port available remotely by using the -g option. Again, you can
do this to privileged ports only if you are root.

Any user who can log in with SSH can expose any
port inside a private network to the outside world
using port forwarding.
As an administrator, if you allow incoming SSH
connections, you're really allowing incoming
connections of any kind. You can configure the
OpenSSH dæmon to refuse port forwarding with
AllowTcpForwarding no, but a determined user can forward anyway.

A config file option is available to forward ports; it is called
LocalForward. The first port-forwarding example given above could
be written as:

Comments

Comment viewing options

This article misses one very useful trick; in addition to port-forwarding and tunneling, the ssh daemon supports SOCKS proxy functions, which means you can use any ssh-enabled hosts as a web proxy. Very useful when you need to test a page from a different country you have a server in, or when you want to access a restricted web administration interfaces by first logging into an inside server.

All you need to activate the SOCKS proxy function is to use the "-D [bind_addr:]port" switch. Ex:

Using your own copy of ssh when using a computer you don't trust doesn't accomplish much. A keylogger that records what you type will record the password you type.

Another idea would be to carry a bootable CD or memory stick with a complete OS that you trust. Knoppix is a good example. This will foil (nearly) any software based keylogger, but you can still be caught by a physical keylogger.

I carry a complete computer that I trust (therefore one not running Windows?) and I type my passwords on it. I also don't recycle passwords from one account on another account.

I am facing some problem with cywin.
I installed cygwin and the installation was successful

I developed a .Net program exe and put it under /cygwin/home/username folder

Now while I am making a ssh call from cygwin command line to that exe application , I get the response as required.
But the same call from the web console is not getting any response.
Its seems like the web console is not making a call the that application.

I got stuck now at this position. Do I need to do some configuration on Cywin to make it accept web request.
Or do i need anything else.

SSH is one of those things I use intensively for a little bit and then go months without thinking about - which means I forget everything between uses. This article is a good reference/checkpoint. Thanks!

One more tip:

GSSAPIAuthentication takes time during initial connection. Set it to "no" in the sshd_config and connections will speed up some.

> Hello.
>
>
> In the article "Eleven SSH Tricks" for Linux Journal, you mention:
>
> >You can configure the OpenSSH daemon to refuse port forwarding with
> >AllowTcpForwarding no, but a determined user can forward anyway.
>
> How can this be done?

from 'man sshd_config' (on debian linux):

AllowTcpForwarding
Specifies whether TCP forwarding is permitted. The default is
``yes''. Note that disabling TCP forwarding does not improve
security unless users are also denied shell access, as they can
always install their own forwarders.

If you trust a user enough to give them ssh access, they
may have the means to forward (at least high-numbered) ports elsewhere.

The converse, allowing ssh but denying shell access, is an issue for
anonymous ssh connections, as with AnonCVS- in this case, turning off
AloowTcpForwarding is a very good idea:

I keep seeing vague references to AllowTcpForwarding being an incomplete solution, but no specific examples of what that means. What does "they can always install their own forwarders" mean? Is it a SSH specific risk or a risk inherent to any shell access (like telnet)? i.e. is there still some way to tunnel traffic through the SSH connection or do they just mean that the user can fire up other processes on the server to do there funny business?

If it's just a risk inherent to giving shell access, then IMHO it's pretty irresponsible to suggest in the man page that "disabling TCP forwarding does not improve security". Does it prevent any and all connectivity to hosts other than the SSH server...of course not. That's a far cry from "does not improve security".

I believe I made a mistake in the "Tunnelled Connections" example- In the fourth paragraph, "tell your mail transport agent" should read "tell your mail user agent". In other words, change the settings in your email program.

The other situation, where you're running your own sendmail/postfix/exim and want to send out mail to the world, punching though an ISP firewall, is only possible if you have access to a mail relay running a ssh server to relay all your outgoing email, which is nearly the same as the above situation with a remote SMTP server.

Since there needs to be a server receiving the SSH connection at the other end, you'd otherwise need to figure out how to set up your mail server to establish a SSH connection to every server you emailed to, which isn't possible with regular SMTP.

Perhaps ultimately we should be happy for that, since if a way to transparently send SMTP over SSH were available, most ISPs would then be compelled to block all ports to prevent SSH connections, instead of only blocking SMTP ports to block spammers, and we'd all have yet another reason to hate spammers...

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.